Custom mobile application sends requests to a custom REST web service on Saleforce. The request contains an external ID, which is saved on the Contact standard object along with customer data. This external ID is the customer's user ID in the custom mobile app. The webservice returns customer data.

Salesforce does not contain the same list of users of the mobile app, only the external IDs on the Contact object.

If I used OAuth with one integration user, anybody using the mobile app can modify the requests to send a different external ID and by trial/error possibly steal data which does not belong to them.

Should this be secured by the mobile app, i.e. should the mobile app always send the request from the mobile app server so that it is impossible to modify the external ID sent, or should there be a different security solution on Salesforce side? If the request must be sent directly from the mobile app client (not server), is there any other solution?

  • Is the custom mobile user ID actually authenticated by some other server? Have you considered SSO?
    – Phil W
    Apr 29, 2023 at 16:59
  • If the mobile application user is accessing or modifying their own data within Salesforce, you may need to be careful about providing access via a single integration user not just from a security perspective, but from a contractual one too. Salesforce specially calls out that using a single user license that essentially acts on behalf of users in this kind of situation is breaching your license agreement. May 2, 2023 at 4:22


You must log in to answer this question.

Browse other questions tagged .